The law doesn't specify, but online sales inherently couldn't comply with the requirements (thumbprint, etc). It's a de facto online sales ban, which might be the strongest challenge available to them.